WordPress Plugin Vulnerabilities

Live Composer < 2.1.23 - Contributor+ Stored XSS via Post Module Pagination

Description

The plugin does not escape a pagination setting supplied through its post-listing module shortcodes before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

Affects Plugins

Plugin icon
live-composer-page-builder
Fixed in 2.1.23

References

CVE
CVE-2026-119073

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Ganjikunta venkata shashank
Submitter
Ganjikunta venkata shashank
Verified
Yes
WPVDB ID
67f28843-96a1-4318-8601-21c90bd5b10e

Timeline

Publicly Published
2026-11-05 (about 2 days ago)
Added
2026-11-05 (about 1 day ago)
Last Updated
2026-11-05 (about 1 day ago)

Other

Published
Title
Published
2026-07-31
Title
Powerkit < 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Published
2025-04-28
Title
Gutenverse < 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via countdown Block
Published
2022-04-21
Title
VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ Stored Cross-Site Scripting
Published
2026-09-23
Title
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid < 7.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-08-20
Title
LiquidPoll <= 3.3.78 - Unauthenticated Stored Cross-Site Scripting via form_data Parameter